allow specific user from LAN to access the facebook.

Go to System > Config > Features and make sure Application Control and Multiple Security Profiles is enabled.

Security Profiles > Application Control select your default profile, configure as needed.

Unter Application Overrides select Add Signatures, search for "Facebook" select all and Use Selected Signatures

Set Action to Block and Apply

In the upper right corner select Clone and name the profile default-allowFailbook

Set action to Allow/Monitor and Apply

To to User & Devices > User > User Groups and create two groups

Go to User & Devices > User > User Definition, create users and put them in the two groups

Go to Policy & Objects > Policy > IPv4 and select Create New

Create two policies from your internal interface to your internet facing interface select Source User(s) and under Security Profiles your two Application Control profiles respectively

Move the policy allowing Facebook on top of the other just to make sure